Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1683359

Re: [RFC][PATCH] exec: Use init rlimits for setuid exec

From Kees Cook <keescook@chromium.org>
Newsgroups linux.kernel
Subject Re: [RFC][PATCH] exec: Use init rlimits for setuid exec
Date 2017-07-07 20:30 +0200
Message-ID <u0GaR-7Kj-11@gated-at.bofh.it> (permalink)
References (7 earlier) <u0tQl-7Je-1@gated-at.bofh.it> <u0u9H-7Qw-3@gated-at.bofh.it> <u0ujn-7Uj-7@gated-at.bofh.it> <u0vfr-5W-3@gated-at.bofh.it> <u0EiK-6wG-17@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

On Fri, Jul 7, 2017 at 9:22 AM, Linus Torvalds
<torvalds@linux-foundation.org> wrote:
> On Thu, Jul 6, 2017 at 11:40 PM, Kees Cook <keescook@chromium.org> wrote:
> So I definitely like this approach, as long as we clarify that crazy
> security_bprm_secureexec() model. That code really is insane.

Yeah, it really seems like security_bprm_secureexec() should be
checking the bprm cred, though there are comments in the LSMs about
why this isn't done. I'll dig through the history there; it may be an
artifact of the old cred installation ordering...

It seems like an LSM would want to see "current creds" and "new creds"
as distinct things for comparing the results, but I'll check it out.

> In contrast, if the code just did:
>
>     if (security_bprm_secureexec(bprm)) {
>         if (current->signal->rlim[RLIMIT_STACK].rlim_cur > _STK_LIM)
>             current->signal->rlim[RLIMIT_STACK].rlim_cur = _STK_LIM;
>     }
>
> and leave the hard limit alone entirely. At least that doesn't let
> anybody escape the limits that the sysadmin has set.

Sounds good to me.

>
> Hmm? Yes, this allows people to try to attack suid binaries with a
> really small stack. But that's a pre-existing attack - do we have
> worries about it?

Agreed, I think that's out of scope for this.

-Kees

-- 
Kees Cook
Pixel Security

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-06 06:40 +0200
  Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Andy Lutomirski <luto@kernel.org> - 2017-07-06 07:00 +0200
    Re: [RFC][PATCH] exec: Use init rlimits for setuid exec ebiederm@xmission.com (Eric W. Biederman) - 2017-07-06 15:00 +0200
      Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Andy Lutomirski <luto@kernel.org> - 2017-07-06 17:30 +0200
  Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Willy Tarreau <w@1wt.eu> - 2017-07-06 07:50 +0200
  Re: [RFC][PATCH] exec: Use init rlimits for setuid exec ebiederm@xmission.com (Eric W. Biederman) - 2017-07-06 14:50 +0200
    Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Andy Lutomirski <luto@kernel.org> - 2017-07-06 17:40 +0200
  Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-06 18:40 +0200
    Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-06 19:00 +0200
    Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-06 19:30 +0200
      Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-06 20:00 +0200
        Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-06 21:20 +0200
          Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Andy Lutomirski <luto@kernel.org> - 2017-07-07 06:50 +0200
            Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-07 07:10 +0200
            Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 07:20 +0200
              Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-07 07:40 +0200
                Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 07:50 +0200
                Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 08:50 +0200
                Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-07 18:30 +0200
                Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 20:30 +0200
              Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Andy Lutomirski <luto@kernel.org> - 2017-07-07 07:40 +0200
                Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 07:50 +0200
                Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-07 08:10 +0200
                Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 08:20 +0200
                Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-07 18:10 +0200
                Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 20:30 +0200
                Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Andy Lutomirski <luto@kernel.org> - 2017-07-07 17:00 +0200
            Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 07:20 +0200
          Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Michal Hocko <mhocko@kernel.org> - 2017-07-10 10:50 +0200
            Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-10 18:20 +0200
              Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Willy Tarreau <w@1wt.eu> - 2017-07-10 19:00 +0200
            Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-10 18:20 +0200
              Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Michal Hocko <mhocko@kernel.org> - 2017-07-10 18:30 +0200
                Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Michal Hocko <mhocko@kernel.org> - 2017-07-10 20:20 +0200
                Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Rik van Riel <riel@redhat.com> - 2017-07-10 20:40 +0200
    Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Alan Cox <gnomes@lxorguk.ukuu.org.uk> - 2017-07-13 02:00 +0200

csiph-web